kryptheon 0.1.28 → 0.1.30

package/bin/kryptheon.js

@@ -2659,8 +2659,22 @@ function accept(name) {
 
   console.error('');
   if (result.reason === 'nothing-pending') {
-    console.error('  "' + titleOf(key) + '" has no new result waiting.');
-    console.error('  Nothing to accept - it last matched its saved result.');
+    // Said from the last run of this test, not assumed: a run that broke on
+    // a step is not one that matched (see baselines.nothingToAcceptLines).
+    const last = baselines.lastRunOf(store.pathsFor(USER_DIR).history, key);
+    baselines.nothingToAcceptLines(titleOf(key), last).forEach((paragraph, i) => {
+      if (i) console.error('');
+      let current = '';
+      for (const word of paragraph.split(' ')) {
+        if ((current + ' ' + word).trim().length > 72) {
+          console.error('  ' + current.trim());
+          current = word;
+        } else {
+          current = (current + ' ' + word).trim();
+        }
+      }
+      if (current) console.error('  ' + current);
+    });
   } else if (result.reason === 'no-entry') {
     console.error('  "' + titleOf(key) + '" has no saved result yet.');
   } else {

package/kryptheon-baselines.js

@@ -166,6 +166,60 @@ function pruneLines(dropped) {
   return lines;
 }
 
+/**
+ * The last run of one recorded test, from the run history: whether it
+ * passed, and where it broke if it did not. Null when it has never run.
+ */
+function lastRunOf(historyFile, key) {
+  let lines = [];
+  try {
+    lines = fs.readFileSync(historyFile, 'utf8').split('\n').filter(Boolean);
+  } catch (e) {
+    return null;
+  }
+  const spec = specOf(key);
+  const title = titleOf(key);
+  for (let i = lines.length - 1; i >= 0; i--) {
+    let entry;
+    try {
+      entry = JSON.parse(lines[i]);
+    } catch (e) {
+      continue;
+    }
+    const test = (entry.tests || []).find((t) => t && t.title === title && specOf(t.specFile) === spec);
+    if (test) return { status: test.status, at: entry.runAt, failure: test.failure || null };
+  }
+  return null;
+}
+
+/**
+ * What accept says when there is nothing it can take, from the last run.
+ *
+ * Found on a blind test (HelixOps): a step was broken on purpose, and accept
+ * answered "it last matched its saved result" - the opposite of what had
+ * happened. accept only takes a run that went all the way through and ended
+ * on a different page; a step that no longer matches is a changed flow or a
+ * broken app, and neither is accepted.
+ */
+function nothingToAcceptLines(name, last) {
+  if (last && last.status === 'failed') {
+    const failure = last.failure || {};
+    const where = failure.line ? ' at line ' + failure.line + (failure.file ? ' of ' + specOf(failure.file) : '') : '';
+    const what = failure.plainLanguage ? ' (' + String(failure.plainLanguage).replace(/\.$/, '') + ')' : '';
+    return [
+      '"' + name + '" has nothing to accept: its last run broke' + where + ', before the end' + what + '.',
+      'accept only covers a run that went all the way through and finished on a different page - ' +
+        'a new address or a new title.',
+      'A step that no longer matches cannot be accepted. If the flow changed on purpose, record it ' +
+        'again (npx kryptheon record). If it did not, the app broke, and npx kryptheon check says what to fix.',
+    ];
+  }
+  if (last && last.status === 'passed') {
+    return ['"' + name + '" has no new result waiting.', 'Nothing to accept - its last run matched its saved result.'];
+  }
+  return ['"' + name + '" has no new result waiting.', 'Nothing to accept - no run has finished on a different page.'];
+}
+
 module.exports = {
   specOf: specOf,
   titleOf: titleOf,
@@ -173,4 +227,6 @@ module.exports = {
   classifyBaselines: classifyBaselines,
   pruneBaselines: pruneBaselines,
   pruneLines: pruneLines,
+  lastRunOf: lastRunOf,
+  nothingToAcceptLines: nothingToAcceptLines,
 };

package/kryptheon-code.js

@@ -412,7 +412,7 @@ function riskyParts(node, scope, code, aliases, out, depth) {
     }
   }
   const text = code.slice(node.start, node.end).replace(/\s+/g, ' ').slice(0, 80);
-  if (!out.some((p) => p.text === text)) out.push({ text: text, origin: origin });
+  if (!out.some((p) => p.text === text)) out.push({ text: text, origin: origin, line: node.loc ? node.loc.start.line : null });
 }
 
 function rootIdentifier(node) {
@@ -432,6 +432,50 @@ function isCatchParam(node, scope) {
 // from itself (count = count + 1) is not followed round in a circle.
 const RESOLVING = new Set();
 
+// The project being read, for a value imported from another of its files:
+// where each file's names lead, and which of them anything ever writes to.
+// Set by scanProject for the length of one read, like FN_PATHS.
+let IMPORTS = null;
+// Which file each parsed program is, so an import is resolved from the file
+// that wrote it - which, once a helper in another folder is being judged, is
+// not the file the sink is in.
+let PROGRAM_FILE = new WeakMap();
+
+/**
+ * Fixed data another file of the project exports - `export const demo = {...}`
+ * of nothing but literals - is as safe as those literals, and only while no
+ * file writes to it. Found on a blind test (LaunchRail): mock-data.js exported
+ * the demo workspace, ui.js rendered it through a shell() helper, and the
+ * import was read as unknown - so a safe page was reported.
+ *
+ * What is followed, and what is not:
+ *   - a named import of a `const` declared at the top of a project file;
+ *   - nothing at all if any file of the project could not be read, since a
+ *     write could be in that file (IMPORTS.blind);
+ *   - a write anywhere - through the import, any other file's import of it,
+ *     a namespace import, a local name given to part of it, or the defining
+ *     file itself - makes it unknown again (IMPORTS.written).
+ * Handing it out - `return demo.flags` - is a read, and is not followed into
+ * whoever receives it. That is the one place a write could still be missed: a
+ * caller that pushes into the very list it was returned. Writing into shared
+ * fixed data that way is rare enough to accept here, and is said so.
+ */
+function fromImport(binding, depth) {
+  if (!IMPORTS || IMPORTS.blind) return 'unknown';
+  const spec = binding.path && binding.path.node;
+  if (!spec || spec.type !== 'ImportSpecifier') return 'unknown';
+  const program = binding.scope && binding.scope.getProgramParent();
+  const here = program && PROGRAM_FILE.get(program.block);
+  if (!here) return 'unknown';
+  const decl = binding.path.parentPath && binding.path.parentPath.node;
+  const from = decl && decl.source && decl.source.value;
+  const name = spec.imported && (spec.imported.name || spec.imported.value);
+  const found = from && name ? IMPORTS.constOf(here, from, name) : null;
+  if (!found) return 'unknown';
+  if (IMPORTS.written.has(found.full + '::' + name) || IMPORTS.written.has(found.full + '::*')) return 'unknown';
+  return classify(found.init, found.scope, found.code, depth + 1);
+}
+
 /** What a name was set to, followed one step back when that says anything. */
 function fromBinding(id, scope, code, depth, aliases) {
   if (id && aliases && Object.prototype.hasOwnProperty.call(aliases, id.name)) return aliases[id.name];
@@ -440,6 +484,7 @@ function fromBinding(id, scope, code, depth, aliases) {
   if (!binding) return 'unknown';
   if (binding.path && binding.path.type === 'CatchClause') return 'error';
   if (binding.kind === 'param') return fromCalls(binding, code, depth);
+  if (binding.kind === 'module') return fromImport(binding, depth);
   const init = binding.path && binding.path.node && binding.path.node.init;
   const later = binding.constantViolations || [];
   if (!init && !later.length) return 'unknown';
@@ -684,9 +729,230 @@ function checkedFirst(p, value, code) {
   return false;
 }
 
-function sinksIn(parser, code, file, lineOffset) {
+/**
+ * The helper a value is the result of: a call to a function this file
+ * declares, or one it imports from a file of the project. Its returns, each
+ * with its scope and its file's code, and the line where the first of them
+ * that is not plain text is built. Null for anything else - an import from a
+ * package, a default export, a function that cannot be found.
+ */
+function helperOf(value, scope, code, file, lineOffset, resolver) {
+  if (!value || !/CallExpression$/.test(value.type) || !value.callee || value.callee.type !== 'Identifier' || !scope) return null;
+  const name = value.callee.name;
+  let fnPath = localFunction(name, scope);
+  let helper = { code: code, file: null, lineOffset: lineOffset };
+  if (!fnPath) {
+    const binding = scope.getBinding(name);
+    const spec = binding && binding.kind === 'module' && binding.path && binding.path.node;
+    if (!spec || spec.type !== 'ImportSpecifier' || !resolver) return null;
+    const from = binding.path.parentPath && binding.path.parentPath.node.source && binding.path.parentPath.node.source.value;
+    const imported = spec.imported && (spec.imported.name || spec.imported.value);
+    const found = from && imported ? resolver(file, from, imported) : null;
+    if (!found) return null;
+    fnPath = found.fnPath;
+    helper = { code: found.code, file: found.file, lineOffset: 1 };
+  }
+  const returns = returnsOf(fnPath);
+  if (!returns.length) return null;
+  const risky = returns.find((r) => classify(r.node, r.scope, helper.code, 0) !== 'safe') || returns[0];
+  return {
+    fn: name,
+    file: helper.file,
+    line: (risky.node.loc ? risky.node.loc.start.line : 1) + helper.lineOffset - 1,
+    code: helper.code,
+    lineOffset: helper.lineOffset,
+    returns: returns,
+  };
+}
+
+/**
+ * Finds a function another file of the project exports, for helperOf. Parsed
+ * once a file; its functions are handed to the map() reader each time, since
+ * that table is rebuilt for every file read.
+ */
+/** The project file a relative import names, or null for a package or nothing. */
+function resolveModule(fromFile, source) {
+  if (!/^\.\.?\//.test(source)) return null;
+  const EXTS = ['', '.js', '.mjs', '.cjs', '.jsx', '.ts', '.tsx', '/index.js', '/index.ts'];
+  const base = path.resolve(path.dirname(fromFile), source);
+  return EXTS.map((ext) => base + ext).find((candidate) => {
+    try {
+      return fs.statSync(candidate).isFile() && CODE_EXT.test(candidate);
+    } catch (err) {
+      return false;
+    }
+  }) || null;
+}
+
+function importResolver(parser, root) {
+  const parsed = new Map();
+  const entryOf = (fromFile, source) => {
+    const full = resolveModule(fromFile, source);
+    if (!full) return null;
+    if (!parsed.has(full)) {
+      let entry = null;
+      try {
+        if (fs.statSync(full).size <= MAX_BYTES) {
+          const code = fs.readFileSync(full, 'utf8');
+          const ast = parser.babelParse(code, full, true);
+          const fns = [];
+          let program = null;
+          parser.traverse(ast, {
+            Program(p) { program = p.scope; },
+            Function(p) { fns.push(p); },
+          });
+          if (program) PROGRAM_FILE.set(program.block, full);
+          entry = { code: code, program: program, fns: fns, file: path.relative(root, full).split(path.sep).join('/') };
+        }
+      } catch (err) {
+        entry = null;
+      }
+      parsed.set(full, entry);
+    }
+    const entry = parsed.get(full);
+    if (!entry || !entry.program) return null;
+    for (const p of entry.fns) FN_PATHS.set(p.node, p);
+    return Object.assign({ full: full }, entry);
+  };
+  const resolve = (fromFile, source, name) => {
+    const entry = entryOf(fromFile, source);
+    if (!entry) return null;
+    const fnPath = localFunction(name, entry.program);
+    return fnPath ? { fnPath: fnPath, code: entry.code, file: entry.file } : null;
+  };
+  // A `const` the file declares at its top, with the value it is given there.
+  resolve.constOf = (fromFile, source, name) => {
+    const entry = entryOf(fromFile, source);
+    if (!entry) return null;
+    const binding = entry.program.getBinding(name);
+    const node = binding && binding.path && binding.path.node;
+    if (!binding || binding.kind !== 'const' || !node || node.type !== 'VariableDeclarator' || !node.init) return null;
+    if (binding.constantViolations && binding.constantViolations.length) return null;
+    return { full: entry.full, init: node.init, scope: binding.path.scope, code: entry.code };
+  };
+  return resolve;
+}
+
+// Methods that change the array, map or set they are called on.
+const MUTATORS = /^(push|pop|shift|unshift|splice|sort|reverse|fill|copyWithin|set|add|delete|clear)$/;
+// Calls that only read what they are given.
+const READS_ONLY = /^(String|Number|Boolean|JSON\.stringify|console\.\w+|Array\.isArray|Object\.(keys|values|entries|freeze|isFrozen))$/;
+// Methods that only read their argument: list.concat(demo.changes) builds a
+// new list and leaves demo alone. push() and the like are not here - they put
+// the value somewhere it can be written through.
+const READS_ARGUMENT = /^(concat|includes|indexOf|lastIndexOf|startsWith|endsWith|localeCompare|has|at)$/;
+
+/**
+ * Whether this use of a name can change what the name holds: an assignment or
+ * delete through it, a mutating method on it, or handing it to a call that
+ * could change it. A local name given to part of it - `const list = demo.flags`
+ * - is followed, since writing to the list writes to demo.
+ */
+function writtenThrough(ref, depth) {
+  if ((depth || 0) > 4) return true;
+  let p = ref;
+  while (p.parentPath && /MemberExpression$/.test(p.parentPath.node.type) && p.parentPath.node.object === p.node) p = p.parentPath;
+  const parentPath = p.parentPath;
+  const parent = parentPath && parentPath.node;
+  if (!parent) return false;
+  if (parent.type === 'UpdateExpression') return true;
+  if (parent.type === 'UnaryExpression' && parent.operator === 'delete') return true;
+  // The target of an assignment, plain or inside a destructuring pattern.
+  let up = p;
+  while (up.parentPath && /^(ObjectProperty|ObjectPattern|ArrayPattern|AssignmentPattern|RestElement)$/.test(up.parentPath.node.type)) up = up.parentPath;
+  const holder = up.parentPath && up.parentPath.node;
+  if (holder && holder.type === 'AssignmentExpression' && holder.left === up.node) return true;
+  if (holder && /^For(Of|In)Statement$/.test(holder.type) && holder.left === up.node) return true;
+  if (/CallExpression$/.test(parent.type)) {
+    if (parent.callee === p.node) {
+      return /MemberExpression$/.test(p.node.type) && MUTATORS.test(calleeName(p.node));
+    }
+    if (parent.arguments.indexOf(p.node) !== -1) {
+      const callee = parent.callee;
+      const full = callee.type === 'MemberExpression' && callee.object.type === 'Identifier'
+        ? callee.object.name + '.' + calleeName(callee) : calleeName(callee);
+      if (/MemberExpression$/.test(callee.type) && READS_ARGUMENT.test(calleeName(callee))) return false;
+      return !(MAKES_SAFE.test(calleeName(callee)) || READS_ONLY.test(full));
+    }
+  }
+  if (parent.type === 'VariableDeclarator' && parent.init === p.node && parent.id.type === 'Identifier') {
+    const alias = parentPath.scope.getBinding(parent.id.name);
+    if (!alias) return true;
+    if (alias.constantViolations && alias.constantViolations.length) return true;
+    return (alias.referencePaths || []).some((r) => writtenThrough(r, (depth || 0) + 1));
+  }
+  return false;
+}
+
+/**
+ * Every project name something writes to, as "<file>::<name>", read once over
+ * the whole project before any file is judged. `blind` when a file could not
+ * be read: a write could be in it, so no import is trusted at all.
+ */
+function projectWrites(parser, files) {
+  const written = new Set();
+  let blind = false;
+  for (const full of files) {
+    let pieces;
+    try {
+      if (fs.statSync(full).size > MAX_BYTES) continue;
+      const source = fs.readFileSync(full, 'utf8');
+      pieces = PAGE_EXT.test(full) ? scriptsIn(source) : [{ code: source }];
+    } catch (err) {
+      blind = true;
+      continue;
+    }
+    for (const piece of pieces) {
+      let ast;
+      try {
+        ast = parser.babelParse(piece.code, full, true);
+      } catch (err) {
+        blind = true;
+        continue;
+      }
+      parser.traverse(ast, {
+        Program(p) {
+          // This file's own top-level names, written to here.
+          for (const name of Object.keys(p.scope.bindings)) {
+            const b = p.scope.bindings[name];
+            if (b.kind === 'module') continue;
+            if ((b.constantViolations && b.constantViolations.length) ||
+                (b.referencePaths || []).some((r) => writtenThrough(r))) {
+              written.add(full + '::' + name);
+            }
+          }
+        },
+        ImportDeclaration(p) {
+          const from = resolveModule(full, p.node.source.value);
+          if (!from) return;
+          for (const spec of p.node.specifiers) {
+            const b = p.scope.getBinding(spec.local.name);
+            if (!b) continue;
+            if (spec.type === 'ImportNamespaceSpecifier') {
+              for (const r of b.referencePaths || []) {
+                const m = r.parentPath && r.parentPath.node;
+                if (m && /MemberExpression$/.test(m.type) && m.object === r.node && !m.computed && m.property.type === 'Identifier') {
+                  if (writtenThrough(r.parentPath)) written.add(from + '::' + m.property.name);
+                } else {
+                  written.add(from + '::*');
+                }
+              }
+              continue;
+            }
+            const name = spec.type === 'ImportDefaultSpecifier' ? 'default' : (spec.imported.name || spec.imported.value);
+            if ((b.referencePaths || []).some((r) => writtenThrough(r))) written.add(from + '::' + name);
+          }
+        },
+      });
+    }
+  }
+  return { written: written, blind: blind };
+}
+
+function sinksIn(parser, code, file, lineOffset, resolver) {
   const found = [];
   const ast = parser.babelParse(code, file, true);
+  PROGRAM_FILE.set(ast.program, file);
   const lineOf = (node) => (node.loc ? node.loc.start.line : 1) + lineOffset - 1;
   const textOf = (node) => code.slice(node.start, node.end).replace(/\s+/g, ' ').slice(0, 160);
   // Calls to plain named functions, so a helper's sink can be judged by what
@@ -704,6 +970,25 @@ function sinksIn(parser, code, file, lineOffset) {
       viaHelper.push({ node: node, sink: sink, value: value, scope: scope, param: param });
       return;
     }
+    // The HTML built by a helper - root.innerHTML = renderBoard(rows) - is
+    // judged by what the helper returns, in its own file, and the place it
+    // puts a value in is named. Found on a blind test (HelixOps): appShell(),
+    // a fixed string in ui.js, was reported as unknown, and renderBoard() was
+    // reported at its call with no word of ui.js:13, where the title goes in.
+    const built = helperOf(value, scope, code, file, lineOffset, resolver);
+    if (built) {
+      const origin = worst(built.returns.map((r) => classify(r.node, r.scope, built.code, 0)));
+      if (origin === 'safe') return;
+      const parts = [];
+      for (const r of built.returns) riskyParts(r.node, r.scope, built.code, undefined, parts, 0);
+      // The line of the first value that goes in, not of the return around it.
+      const first = parts.find((p) => p.line);
+      found.push({
+        line: lineOf(node), sink: sink, expression: textOf(value), origin: origin, parts: parts,
+        helper: { fn: built.fn, file: built.file, line: first ? first.line + built.lineOffset - 1 : built.line },
+      });
+      return;
+    }
     const origin = classify(value, scope, code, 0);
     if (origin === 'safe') return;
     found.push({ line: lineOf(node), sink: sink, expression: textOf(value), origin: origin, parts: partsOf(value, scope) });
@@ -834,36 +1119,49 @@ function scanProject(root, options) {
     }
   }
   const loadedBy = keys.scriptsLoadedBy(pages);
-  for (const full of files) {
-    let size = 0;
-    try {
-      size = fs.statSync(full).size;
-    } catch (err) {
-      continue;
-    }
-    const rel = path.relative(root, full).split(path.sep).join('/');
-    if (size > MAX_BYTES) {
-      unreadable.push({ file: rel, why: 'larger than ' + Math.round(MAX_BYTES / 1024) + ' KB, probably generated' });
-      continue;
-    }
-    const source = fs.readFileSync(full, 'utf8');
-    filesRead++;
-    for (const k of keys.secretsIn(rel, source, loadedBy)) secrets.push(k);
-    const pieces = PAGE_EXT.test(full) ? scriptsIn(source) : [{ code: source, line: 1 }];
-    for (const piece of pieces) {
+  const resolver = importResolver(parser, root);
+  // Before any file is judged: which of the project's own names anything
+  // writes to, so fixed data is only trusted while it really is fixed.
+  PROGRAM_FILE = new WeakMap();
+  IMPORTS = Object.assign({ constOf: resolver.constOf }, projectWrites(parser, files));
+  try {
+    readAll();
+  } finally {
+    IMPORTS = null;
+  }
+  return { ran: true, filesRead: filesRead, findings: secrets.concat(findings.map(describe)), unreadable: unreadable };
+
+  function readAll() {
+    for (const full of files) {
+      let size = 0;
       try {
-        for (const f of sinksIn(parser, piece.code, full, piece.line)) findings.push(Object.assign({ file: rel }, f));
+        size = fs.statSync(full).size;
       } catch (err) {
-        unreadable.push({ file: rel + (piece.line > 1 ? ':' + piece.line : ''), why: 'could not be parsed: ' + String(err.message).split('\n')[0].slice(0, 120) });
+        continue;
       }
-    }
-    if (/\.(vue|html)$/i.test(full)) {
-      for (const v of vHtmlIn(source)) {
-        findings.push({ file: rel, line: v.line, sink: 'v-html', expression: v.expression, origin: 'unknown' });
+      const rel = path.relative(root, full).split(path.sep).join('/');
+      if (size > MAX_BYTES) {
+        unreadable.push({ file: rel, why: 'larger than ' + Math.round(MAX_BYTES / 1024) + ' KB, probably generated' });
+        continue;
+      }
+      const source = fs.readFileSync(full, 'utf8');
+      filesRead++;
+      for (const k of keys.secretsIn(rel, source, loadedBy)) secrets.push(k);
+      const pieces = PAGE_EXT.test(full) ? scriptsIn(source) : [{ code: source, line: 1 }];
+      for (const piece of pieces) {
+        try {
+          for (const f of sinksIn(parser, piece.code, full, piece.line, resolver)) findings.push(Object.assign({ file: rel }, f));
+        } catch (err) {
+          unreadable.push({ file: rel + (piece.line > 1 ? ':' + piece.line : ''), why: 'could not be parsed: ' + String(err.message).split('\n')[0].slice(0, 120) });
+        }
+      }
+      if (/\.(vue|html)$/i.test(full)) {
+        for (const v of vHtmlIn(source)) {
+          findings.push({ file: rel, line: v.line, sink: 'v-html', expression: v.expression, origin: 'unknown' });
+        }
       }
     }
   }
-  return { ran: true, filesRead: filesRead, findings: secrets.concat(findings.map(describe)), unreadable: unreadable };
 }
 
 const ORIGIN_WORDS = {
@@ -931,9 +1229,14 @@ function describe(f) {
   if (f.kind === 'redirect') return describeRedirect(f);
   const severity = f.origin === 'unknown' ? 'MEDIUM' : 'HIGH';
   const how = f.sink === 'v-html' ? 'v-html' : f.sink;
+  // Where the helper builds it: its own file when it is another one.
+  const builtAt = f.helper ? (f.helper.file ? f.helper.file + ':' : 'line ') + f.helper.line : '';
   const where = f.via
     ? 'In ' + f.file + ' at line ' + f.line + ', this value is passed to ' + f.via.fn + '(), which puts ' +
       'what it is given into the page as HTML with ' + how + ' at line ' + f.via.line + ':'
+    : f.helper
+    ? 'In ' + f.file + ' at line ' + f.line + ', the HTML that ' + f.helper.fn + '() builds - at ' + builtAt +
+      ' - is put into the page with ' + how + ':'
     : 'In ' + f.file + ' at line ' + f.line + ', this value is put into the page as HTML with ' + how + ':';
   // The fix for a helper is different, and getting it wrong breaks the page:
   // switching the helper to textContent makes every other call - the ones
@@ -946,6 +1249,12 @@ function describe(f) {
         'this value before it is joined into the HTML (replace & < > " \' with their HTML entities), ' +
         'or pass it through a sanitizer such as DOMPurify if it must keep some formatting.',
     ]
+    : f.helper
+    ? [
+      'Fix it inside ' + f.helper.fn + '() at ' + builtAt + ', where the values are joined into the HTML: ' +
+        'escape each dynamic value there (replace & < > " \' with their HTML entities), or pass the ' +
+        'result through a sanitizer such as DOMPurify if it must keep some formatting.',
+    ]
     : [
       'Fix it so the value is always shown as text: set textContent instead of innerHTML for the ' +
         'dynamic part, or escape it before it is joined into HTML (replace & < > " \' with their ' +
@@ -993,9 +1302,11 @@ function describe(f) {
     origin: f.origin,
     parts: (f.parts || []).map((p) => ({ text: p.text, origin: p.origin })),
     via: f.via || null,
+    helper: f.helper || null,
     headline: 'Text ' + (f.origin === 'unknown' ? 'of unknown origin' : ORIGIN_WORDS[f.origin].split(',')[0]) +
       ' is inserted as HTML in ' + f.file + ':' + f.line +
-      (f.via ? ' (through ' + f.via.fn + '() at line ' + f.via.line + ')' : '') + '.',
+      (f.via ? ' (through ' + f.via.fn + '() at line ' + f.via.line + ')' : '') +
+      (f.helper ? ', built by ' + f.helper.fn + '() at ' + builtAt : '') + '.',
     fixPrompt: fixPrompt,
   };
 }